Alias:W32/Lilac
Type:Worm 
Size:12.208 Bytes 
Origin: 
Date:07-08-2002 
Damage:Worm/Calil spreads by email. 
VDF Version:6.23.00.00 
Danger:Low 
Distribution:Low 

DistributionIt sends itself to all email addresses in WAB (Windows Address Book) using Outlook. The email looks like this:

Subject: FW:FW: LILAC project video attach
Body: Things that the govt. dont want you
Attachment:
Lilac_What_a_wonderfulname.avi.exe
It is possible that the attachment may have 0 Bytes or it may be completely forgotten. This happens because of a worm programming error.

Technical DetailsWorm/Calil is an 12208 Bytes (30720Bytes unpacked)Internet worm, written in Visual Basic language.
When activated, the worm sends itself using Outlook to all email addresses in WAB.
When the email attachment is opened, a window is displayed, while the worm copies itself as "Lilac_What_a_wonderfulname.avi.exe" in one of the directories:
C:\Win98\Temp\
C:\Win95\Temp\
C:\Winnt\Temp\
C:\Winme\Temp\
C:\Winxp\Temp\
C:\Windows\Temp\

Then, the worm changes the following registry key:
-[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion] RegisteredOwner=xEnOcrAtEsLegalNoticeCaption=Owned by:LegalNoticeText=Owned by: xEnOcrAtEs
and makes the following entry:
-[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Lilac"="c:\\windows\\temp\\LILAC_WHAT_A_WONDERFULNAME.avi.exe"

If the worm is not correctly activated, the following non-virulent messages appear in Autoexec.bat:
echo MERRY CHRISTMASS AND A HAPPY NEW YEAR !!!
echo HAPPY HALLOWEEN !!!
echo HAPPY VALENTINES DAY !!!
echo HAPPY LABOR DAY !!!
echo BONIFACIO DAY !!!
echo RIZAL DAY !!!
echo HAPPY INDEPENDENCE DAY !!!
echo HOLY WEEK !!!
@echo off
echo from: OPEY A . pause
Description inserted by Crony Walker on Tuesday, June 15, 2004

Back . . . .